If you received a “you’re preapproved to upgrade,” “upgrade precheck complete,” or “your line is ready for upgrade” email from your carrier—but you never started an upgrade—treat it as an early signal of SIM-swap activity. Criminals test the waters by probing your carrier account before they attempt to move your phone number to a SIM they control. Catching this stage early can stop a full account takeover, protect your text-based logins, and prevent financial fallout.
What Is a SIM Swap—and Why Upgrade Emails Matter
A SIM swap is when an attacker transfers your phone number to a new SIM card or device they control. Once they control your number, they can intercept text messages and calls, reset passwords that use SMS verification, and break into bank, email, and crypto accounts. An unsolicited “upgrade precheck” email is often a precursor: it can indicate someone is checking eligibility, confirming line details, or preparing to process a device or line change on your account.
Common “Precheck” or “Upgrade” Language You Might See
- “Your line is eligible and prechecked for upgrade.”
- “We verified your account—complete your upgrade.”
- “A device upgrade was started for line ending in ••12.”
- “Your upgrade order is in review—confirm details.”
Even if the email looks legitimate, you didn’t initiate it. That mismatch is your red flag.
Confirm Legitimacy Without Getting Phished
Don’t click links or call numbers inside the message. Instead:
- Go out-of-band: Open your carrier’s official app or type the carrier’s URL directly into your browser. Or call the number on the back of your SIM packaging or your billing statement.
- Ask for “recent change history”: Request a log of the past 30 days: upgrade checks, SIM changes, port-out attempts, address/email changes, and store-initiated inquiries.
- Verify contact details: Confirm the primary email, phone numbers on file, shipping address, authorized users, and PIN/passcode.
Immediate Actions to Lock Down Your Line
Move fast to add friction so attackers can’t complete a swap or device upgrade.
- Add a carrier account PIN or passcode (or change it now): Use a unique 6–10 digit PIN not used anywhere else. Avoid birthdays, addresses, or patterns.
- Enable a SIM-swap/port-out lock: Many carriers support a “number lock,” “port freeze,” or “no port without in-person ID.” Turn it on for every line on the account.
- Set account alerts: Enable text, email, and app alerts for SIM changes, port requests, new device activations, and address or email changes.
- Remove unused lines and authorized users: Attackers often target secondary lines or users with weaker controls.
- Require in-person verification: Ask your carrier to require government ID for any device upgrade or SIM replacement.
- Audit store-level notes: Ask support to add a note: “Do not process upgrades or SIM changes without verifying photo ID and account PIN.”
Check Your Email and Identity Perimeter
SIM swaps often follow earlier compromises. Harden the accounts that protect everything else.
- Secure your primary email: Change the password to a long, unique passphrase; enable phishing-resistant MFA (security key or app-based TOTP, not SMS).
- Review recent email logins and forwarding rules: Attackers add hidden forwarding to capture password resets.
- Rotate passwords on key accounts: Bank, brokerage, payment apps, password manager, and cloud storage.
- Remove your number from sensitive 2FA where possible: Switch to app-based codes or security keys to reduce SIM-swap impact.
Tell-Tale Signs a SIM Swap Is Imminent
Watch for patterns that escalate from “precheck” to takeover:
- Multiple carrier messages about upgrades, device activations, or line changes you didn’t start.
- Sudden loss of cellular service (no bars or only “SOS”) while others on your carrier have normal service.
- Password reset messages arriving for bank, email, or crypto accounts.
- Login alerts from new devices or locations you don’t recognize.
- Customer support references to recent store visits or phone calls you didn’t make.
If You Lose Service or See an Unauthorized Change
Act as if a takeover is happening now.
- Use Wi‑Fi to contact your carrier immediately: Call from another line or use the carrier’s app/web chat. State: “Suspected SIM swap or unauthorized upgrade. Freeze my line and reverse changes.”
- Request a temporary block: Ask for an urgent “fraud hold” on all lines, reversal of SIM/port changes, and a new account number and PIN if needed.
- Get documentation: Ask for a case number, a transcript or notes, and confirmation of every reversal.
- Reissue credentials: After service is restored, change your carrier account password and PIN again from a trusted device.
- Lock down financial accounts: Change passwords, enable app-based MFA, and monitor for unusual transactions.
Preventive Settings to Enable Before There’s a Problem
Solid prevention reduces the chance a random eligibility check turns into a full swap.
- Carrier features: SIM/port lock, strong account PIN, ID verification requirement, upgrade authorization limits, and alerts.
- Account hardening: Use a password manager and unique passwords; enable app-based MFA or security keys; remove SMS as a fallback where possible.
- Device security: Keep iOS/Android updated; enable device PIN/biometric; disable SIM PIN only if your carrier’s SIM lock feature conflicts—otherwise, consider using a SIM PIN for local theft risk.
- Reduce public exposure of your number: Avoid posting your personal number online; use a separate number for signups or public profiles.
- Data broker opt-outs: Remove your phone number and address from people-search sites that fuel social engineering of carrier reps.
Why Attackers Trigger “Precheck” First
Criminals probe eligibility to learn which lines can be upgraded without raising flags, whether the account has a strong PIN, and which stores or online channels will allow changes with minimal friction. This recon helps them time a swap right before they attempt password resets on your financial accounts—often late at night or on weekends. Treating a single unexpected upgrade email as a serious signal can break this chain early.
Document and Escalate Properly
If you confirm an unauthorized action, keep records. They help you with carrier escalation and any downstream financial disputes.
- Screenshots and headers: Save the email, including full headers if available, and any SMS alerts.
- Carrier logs: Ask for the exact time, channel (store/phone/web), and location of any attempted change.
- Police or FTC reporting: For confirmed fraud, consider filing reports to create a paper trail if financial accounts are affected.
Protect Your Financial Identity While You Investigate
Because SIM swaps target accounts that use SMS for verification, monitor your credit and identity-related activity closely during and after an incident. Consider setting credit bureau fraud alerts or credit freezes and use active monitoring to detect new-account openings, sudden score changes, or inquiries you don’t recognize. A dedicated monitoring tool that unifies alerts and gives you quick visibility into credit changes can help you respond faster. If you find it useful to centralize credit and identity monitoring while you harden your accounts, see our guide: SmartCredit for privacy, credit monitoring, and identity protection.
Frequently Asked Questions
Is an upgrade-precheck email always fraud?
Not always. Carriers send marketing emails about eligibility. The risk is when the email references a specific line, order-in-review, or a change you didn’t start. Verify directly with your carrier and check the account’s change history.
Will a port-out lock stop all SIM swaps?
It significantly raises the barrier, but no single control is perfect. Pair it with a strong account PIN, in-person ID requirements, and alerts.
Should I remove SMS 2FA everywhere?
Where possible, yes—prefer app-based codes or security keys. If a service only supports SMS, keep your number locked and monitored, and consider a separate number not used publicly.
Do eSIMs make swaps safer?
eSIMs remove the physical card, but the risk remains if an attacker convinces the carrier to provision a new eSIM. Your best defense is strong account controls and vigilant monitoring.
A Quick Step-by-Step Response Plan
- Don’t click links. Access your carrier via the official site/app or a verified phone number.
- Check change history. Look for upgrade checks, SIM activities, or address/email changes.
- Lock the account. Add or change your PIN; enable port/number locks; require in-person ID.
- Harden email and 2FA. Change email password; enable app-based MFA; remove SMS where possible.
- Monitor finances. Add alerts at banks; consider credit monitoring; place fraud alerts or freezes if needed.
- Document everything. Save emails, case numbers, and support transcripts.
Red Flags That Deserve Immediate Carrier Contact
- “Your device upgrade is ready to ship” when you didn’t order one.
- Store visit notes or phone support notations you don’t recognize.
- Primary email or shipping address changed without your action.
- Loss of service coinciding with password reset emails from financial apps.
Conclusion
An unsolicited “upgrade precheck” email is more than marketing noise—it can be your earliest warning that someone is preparing a SIM swap. Verify out-of-band, lock down your carrier account with strong PINs and port locks, harden your email and two-factor settings, and watch your financial identity for unusual activity. Fast action at this stage can prevent number hijacking, protect your logins, and save you hours of recovery work later.
Good to Know
Legitimate carriers usually won’t ask you to click links to confirm an upgrade out of the blue. Call the number printed on your actual bill or the carrier’s website and ask for a recent “change history” review on your account.